The SuperImager® Plus Forensic Field Unit with Thunderbolt port-is a mobile, super compact, easy to carry, affordable, powerful hardware and extremely fast Forensic Imaging unit that enable the user to capture data from almost every digital storage device in a very easy way. The unit is supplied with Thunderbolt 3.0 Expansion box with PCIe 3.0 x4 and it is running under Linux Ubuntu OS which is less targeted OS by malware, and it reduces the OS performance overhead The unit can be used to perform:

The unit has the ability to capture from: SAS, SATA, IDE, USB3.0, SCSI, FC, 1394, USB3.1, NVMe interfaces by plugging the appropriate controller into the Expansion Box. Also, it can be used with 10Gigabit/s network controller

Dual Boot Option: The unit is running Ubuntu OS for Forensic Imaging and Virtual Drive Emulator purpose. The dual boot to Windows is optional for additional cost. It needed when the user intends to install and use third-party applications to perform data analysis, cellphone extraction and more

• USB3.0 to SATA 4 Channel Kit. User can convert 4 USB3.0 ports to 4 SATA ports at high speed up to 20GB/min. (The Kit includes 4 USB3.0 to SATA drive caddies with 1 external PS to power the 4 SATA hard disk drives) USB3.0 to SATA adapter 4 Channel KIT+ Power

Features

Main Hardware Features:

Case: portable, easy to carry

CPU: i7 Gen-6

Display: 6" Color LCD display with HDMI port

Hardware: High quality and high performing components

Hardware upgrade: The unit can be upgraded at time of purchasing for additional cost, to a large internal SSD, or to 32GB internal memory

OS: Linux Ubuntu 64 Bit

Application Updates: The application can be easily updated via USB thumb drives and special update screen

Application Settings:

HPA/DCO Automatic Supports: The application has the ability to automatically open HPA and DCO areas, and resize the "Suspect" drive to its full native capacity, in order to capture any “hidden data” (HPA/DCO are special areas on the drive that support this feature)

Bad Sectors Handling: The user can select to skip bad sectors or a block of bad sectors, or to abort the operation when it encounters bad sectors on the "Suspect" drive

Ports:

Forensic Images Destination: The user can save Forensic Images to a local network shared folder for easy access and analysis, or save images to external USB3.0 RAID (encryption is optional) storage in a very good speed

Easy Capture from almost any Storage Protocols and Interfaces: SAS, SATA, e-SATA enclosures, IDE, USB2.0, USB3.0, USB3.1, MMC, M.2 NGFF(SATA, or PCIE base), NVMe 2.5" or M.2, 1394, Thunderbolt, FC, and SCSI (The user just plug the appropriate storage controller in the Thunderbolt expansion box which connected to the main unit)

Cross Copy from Ports and Interfaces: The user can choose to capture from one type of port with one kind of storage protocol and interface, and save the forensic Image into a different port with a different storage protocol and interface. The cross copy of data can be done between SAS/SATA/IDE/USB/SCSI/1394/FC/NVMe interfaces

Application Features:

GUI: The application is built with large icons and is very simple and easy-to-navigate. In a few clicks, the user can set the operation, and it will be quickly up and running

Extreme Speeds when performing Forensic capture with E01/EX01 formats and with full Compression:

• The new Linux-based SuperImager Plus application utilizes and optimizes multiple CPU cores to achieve one of the most efficient operations while performing at incredibly high speeds with E01/EX01 compression. The application allows the user to manually select and adjust the number of hyper threads and the level of compression used during each session

• Forensic data capture with Encase E01/Ex01 formats with full compression is widely used operation in the forensic industry, and generally requires a trade-off between speed, space, and the time of decompressing by the EnCase application

Decryption:The user can perform decryption on a drive, previously encrypted by any of the SuperImager units. Alternatively, the user can use a standalone MediaClone Linux decryption utility application to perform decryption on that drive using any PC. The supplied standalone decryption utility application can be burned onto a USB flash drive that later can be used to boot the PC to the Linux utility, where the encrypted drive and a blank destination drive were attached to the PC. (The user needs to supply to the utility application the saved encryption key)

Parallel Forensic Imaging - Multiple Session Operations: The user can run multiple efficient parallel operations since many ports are available. The user can mix different type of operations, and in each operation, he/she can set as a new independent session. An example of operations: erase data from a hard disk drive on one port, hash verify on second port, while forensic imaging 1 to 1 on the remaining ports

Source Ports:

2 SATA ports (inside the Thunderbolt 3.0 box) (Write-Protected)

Evidence Ports and parallel operations between them:

USB3.0 ports: 4 ports (copy up to 2:2)

SATA target ports: With the use of USB3.0 to SATA adapters, the user can convert 4 USB3.0 ports to be 4 SATA ports (copy 2:2). Example of speed using the USB to SATA adapter (capture of 1TB hard disk drive via the USB adapter at 9GB/min)

Parallel operations – Linux Elaborated:

Drive Detection Application Screen: All drives and storage devices that are connected to the unit will be scanned and displayed in one application screen called “the detection screen”. The user can tap on each drive to get its detailed info, as well as selecting it for the desired operation they are planning to use

Parallel Forensic Imaging: It depends on the number and the kind of ports that each model has. The application is very flexible in running multiple sources to multiple destinations, all in simultaneous operations. The user has the flexibility to change a role of a port from been Evidence port to be Suspect port and he/she is not limited by the pre assigned "Suspect" ports. The session control application screen provides the user with a very comprehensive information and control over the running sessions, include the detailed setting of the session, and the ability to abort the session

Parallel Forensic Imaging - Multiple Session Operations: The user can run multiple efficient parallel operations and can mix different type of operations; for example erase drive on one port, HASH verification on another port, while performing forensic imaging on other ports (each operation can function as a

Remote Capture - Capture Data from the Internal Drives of a Computer (Intel CPU): Using USB or 1Gigabit Ethernet ports of the laptop/computer, enables capture without the needs to remove the drive from the Laptop/computer (The captured speed is restricted to performance of the Laptop/PC CPU and the 1Gigabit/s connection)